Pentagon Breach Exposes 3M Records
A file-sharing vulnerability inside the Defense Manpower Data Center left unencrypted Social Security numbers, birth dates, contact data, and military job records exposed for months.
The Pentagon’s personnel bureaucracy left unencrypted records of more than 3 million military-connected people exposed through a file-sharing vulnerability for months.
The breach struck the Defense Manpower Data Center, the Pentagon’s central personnel-records system. A Defense official told ABC News that unauthorized users accessed the system between October 2025 and July 2026.
The official count: 2.76 million living people and another 294,000 deceased people. The records span active-duty troops, reservists, veterans, retirees, civilian employees, contractors, and military family members. The headline figure includes that broader military-connected population.
The exposed files contained unencrypted personal data. Depending on the person, that included names, contact information, dates of birth, Social Security numbers, and military personnel information, including occupational specialty. Federal News Network reported the Pentagon declined to identify who accessed the data, whether the intrusion was intentional, or why the records sat on an unencrypted server.
The Defense Manpower Data Center found the flaw in its file-sharing system on July 16 and patched it, according to the breach notice reviewed by Military Times.
Officials say they have found no indication the information has been misused. Their remedy is a year of credit monitoring and identity-restoration services through contractor IDX.
The system holding more than 60 million Defense Department records was not breached for an afternoon. Unauthorized users had access from October to July. The people whose Social Security numbers and military histories were exposed will carry that risk long after the Pentagon’s 12-month monitoring offer expires.